Representational state transfer (REST) is a style of software architecture for distributed media systems such as the World Wide Web. The REST architectural style governs the behavior of participants, and identifies a number of constraints. REST was initially described in the context of Hypertext Transfer Protocol (HTTP), but is not limited to HTTP. Applications that comply with the constraints or recommendations of REST are described as being RESTful. RESTful applications typically make use of existing, well defined interfaces and capabilities.
The REST architectural style describes a number of constraints to the architecture while leaving the implementation of the individual components flexible and up to the protocol designer. According to these constraints, clients and servers are typically separate or communicate via a uniform interface. For example, HTTP allows several standard methods such as Get, Post, Put, Delete, etc. In addition, REST software architecture typically involves a stateless protocol in which no client context is stored on the server between requests. State information may be stored on the server, such as resources. For example, resources stored on the server may be addressable or accessible via an identifier or URL (Uniform Resource Locator). Also, the client may store state information. A layered system or a layered architecture is typically used for REST based architectures, and in such cases, clients may not be able to determine whether it is connected directly to an end server or to an intermediary (or intermediate device or client) along the way.
HTTP is an example of a RESTful protocol. RESTful protocols, such as HTTP, may include limited features or fields for communicating security credentials. For example, hash values may be provided within HTTP headers. However, RESTful protocols, such as HTTP, do not typically allow for other, more complex security credentials (such as security tokens or certificates, etc.) to be communicated within HTTP messages or requests. Therefore, REST clients and REST servers (such as, for example, HTTP clients and servers) may be limited in their ability to communicate security credentials and perform some types of security related functions.